Lucene search

[email protected]CVE-2023-26512

HistoryJul 17, 2023 - 8:15 a.m.

CVE-2023-26512

2023-07-1708:15:09

CWE-502

[email protected]

web.nvd.nist.gov

cve-2023-26512

cwe-502

apache eventmesh

rabbitmq-connector plugin

remote code execution

nvd

security

vulnerability

patch

update

fix

master branch

project repo

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.9%

JSON

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue, we will release the new version as soon as possible.

Affected configurations

Vulners

NVD

Node

apacheeventmeshRange≤1.8.0

CPENameOperatorVersion
apache:eventmeshapache eventmeshle1.8.0

CPE	Name	Operator	Version
apache:eventmesh	apache eventmesh	le	1.8.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache EventMesh (incubating) RabbitMQ connector",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.8.0",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "maven"
      }
    ]
  }
]